Ultimate Member myCRED

What it is The Ultimate Member myCRED Addon is a premium extension for the Ultimate Member plugin, designed to integrate user roles, profiles and membership features of Ultimate Member with the myCRED points system (or credits system) on WordPress. It links user activity, membership status and points/credits in a community/membership website context. Version 2.2.9 is one of the recent builds of this addon (you mention 2.2.9) — this version number suggests it’s beyond some of the earlier minor releases and likely includes some bug fixes and improvements over earlier 2.x versions. 🔍 What we know about security and compatibility (relevant to this addon) Security vulnerabilities in Ultimate Member core The Ultimate Member core plugin (not necessarily the myCRED addon) has multiple publicly documented vulnerabilities: There is a second-order SQL injection vulnerability in Ultimate Member up to version 2.9.2. There is an information exposure vulnerability in Ultimate Member up to version 2.9.1. Patchstack and other sources list many vulnerabilities in Ultimate Member (SQLi, arbitrary function call, etc) affecting versions ≤2.10.3. Because the myCRED Addon depends on Ultimate Member, any vulnerabilities in the core plugin also affect the addon’s risk surface. What we don’t clearly have I did not find a public CVE that specifically names version 2.2.9 of the myCRED Addon itself (i.e., the integration between myCRED + UM). There is no clear public disclosure of a major vulnerability only in that addon version. However, the lack of disclosure is not a guarantee of safety.